bmad-cis-agent-presentation-master
Warn
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill runs a local script located at
{project-root}/_bmad/scripts/resolve_customization.pyusinguv runas part of its activation process. - [COMMAND_EXECUTION]: The skill is designed to execute arbitrary entries in the
activation_steps_prependandactivation_steps_appendarrays, which are merged from external configuration files like{project-root}/_bmad/custom/{skill-name}.toml. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests data from external sources and uses it to drive agent behavior and execution. * Ingestion points: Configuration is loaded from
config.yaml, personal and team TOML overrides, and file paths matched bypersistent_factsglobs. * Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded directives in the loaded external content. * Capability inventory: The skill has the ability to execute shell commands and read arbitrary files from the filesystem. * Sanitization: No sanitization or filtering is applied to the data retrieved from external files before it influences the agent's persona or execution steps.
Audit Metadata